G_Wagon npm Package Attacking Users to Exfiltrates Browser Credentials using Obfuscated Payload
On January 23, 2026, security researchers identified a malicious npm package named ansi-universal-ui , which masqueraded as a legitimate user interface component library. This package was found to contain G_Wagon , a sophisticated multi-stage information…
On January 23, 2026, security researchers identified a malicious npm package named ansi-universal-ui , which masqueraded as a legitimate user interface component library. This package was found to contain G_Wagon , a sophisticated multi-stage information stealer engineered to extract sensitive data from users' systems.
The G_Wagon malware operates as an advanced attack framework, downloading its Python runtime and executing obfuscated code to exfiltrate browser credentials, cryptocurrency wallet data, cloud credentials, and messaging tokens. It employs a Windows DLL injected into browser processes via native NT APIs, highlighting its technical complexity. The exfiltrated data is sent to Appwrite storage buckets under the attackers' control.
The infection mechanism is activated through a postinstall hook when users install ansi-universal-ui , which automatically triggers the malicious code. The dropper component retrieves a Python payload from command and control servers, executing it in memory to avoid disk writes.
This package was found to contain G_Wagon , a sophisticated multi-stage information stealer engineered to extract sensitive data from users' systems.
G_Wagon's rapid evolution demonstrates its capacity for detection evasion. Over two days, the attackers released ten versions of the package, refining their methods. Initial versions included test scripts for infrastructure, while version 1.3.5 introduced legitimate-seeming branding and documentation. Later versions utilized enhanced obfuscation, including hex-encoded command and control URLs and renamed directories and variables to disguise the malware as a graphics rendering component.
The attackers also implemented techniques to pipe payloads through stdin, avoiding the creation of forensic artifacts. They demonstrated the ability to quickly address bugs and adapt their strategies, incorporating anti-forensics features like automatic payload deletion.
Organizations are advised to immediately remove versions 1.3.5 through 1.4.1 of the malicious package, reset all stored browser credentials, revoke cryptocurrency wallet extensions, and regenerate cloud provider credentials.
Based on reporting by Cyber Security News.